# Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)

DoD Pulse Secure VPN instance vulnerable to pre-auth path traversal file read, enabling cleartext credential theft and chained post-auth command injection to root RCE.

- Payout: hidden
- Severity: high
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2024-06-18
- CVE: CVE-2019-11510, CVE-2019-11542, CVE-2019-11539, CVE-2019-11538, CVE-2019-11508, CVE-2019-11540
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/696276
- Library page: https://bugbountylibrary.com/r/h1%3A696276
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:curl technique:chained vuln:command-injection vuln:path-traversal vuln:rce

**Target:** Pulse Secure SSL VPN web endpoint (/dana-na/)
**Root cause:** Path traversal in the Pulse Secure web component allows unauthenticated reading of arbitrary files via crafted /dana-na/../dana/html5acc/guacamole/ paths; credentials stored in cleartext enable post-auth command injection.
**Steps:**
1. Send `curl -i -k --path-as-is https://TARGET/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/`
2. Observe /etc/passwd contents confirming traversal
3. Read cleartext credential store via same traversal
4. Authenticate to VPN with stolen credentials
5. Exploit CVE-2019-11539 post-auth command injection for root RCE
**How found:** Researcher recognized the target ran Pulse Secure and applied Orange Tsai's published BlackHat/Defcon 2019 techniques, testing the known traversal path against the instance.
**Exploitation:** Attacker uses pre-auth path traversal to read /etc/passwd and the cleartext credential file, logs into the VPN, then leverages post-auth command injection (CVE-2019-11539) to execute commands as root and pivot into the intranet.
**Escalation:** Chained file-read (CVE-2019-11510) to credential theft to authenticated command injection (CVE-2019-11539) for root RCE and intranet access.
**Insight:** Known-vuln hunting on VPN appliances pays: fingerprint the Pulse Secure /dana-na/ path and replay the published traversal with --path-as-is; cleartext credential storage turns a file-read into full auth and RCE chain.